CVE-2025-56379

CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext v15.67.0 / Frappe v15.72.4. An authenticated user who can create or edit blog posts may inject crafted HTML/JavaScrip...

CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

CVE-2025-56381

CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...

CVE-2025-28062

CVE-2025-28062 — CSRF Vulnerability to Account Takeover in ERPNext 14.82.1 , 14.74.3 📌 Summary A Cross-Site Request Forgery CSRF vulnerability was discovered in ERPNext 14.82.1 and 14.74.3 , allowing attackers to perform unauthorized actions such as: User enumeration Account takeover password res...

CVE-2022-28598

ERPNext - 12.29.0 Stored cross-site scripting XSS vulnerability in the "lastknownversion" field found in the "My Setting" page in ERPNext 12.29.0 allows remote attackers to inject arbitrary web script or HTML via a crafted site name by doing an authenticated POST HTTP request to...

CVE-2026-124315

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124314

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

CVE-2026-124316

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124313

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getlinkedpaymentsfordoc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocatio...

CVE-2026-124316 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124316

Frappe ERPNext versions prior to 15.121.4 and 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.buying.utils.get_linked_material_requests method. The root cause is a lack of document or company permission checks, allowing authenticated users—including portal users or those wit...

CVE-2026-124316 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

EUVD-2026-119270

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124316 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124315 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124315 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124314 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

EUVD-2026-119269

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124314 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

CVE-2026-124314

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.crm.utils.get_open_activities component. This vulnerability allows any authenticated user, including those with no specific roles or portal access, to perform unauthorized...